,,ii #aagth ,,congress #ast ,session ,s4 #cjii ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,october #bh1 #bjba,mr4 ,peters 7for himself1 ,ms4 ,hassan1 ,mr4 ,hawley1 and ,mr4 ,daines7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to amend title #dd1 ,united ,states ,code1 to establish the ,federal ,risk and ,authorization ,management ,program within the ,general ,services ,administration1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,secure ,cloud ,improvement and ,jobs ,act of #bjba4 #b4 ,findings ,congress finds the following3 7#a7 ,ensuring that the ,federal ,government can securely leverage cloud computing products and services is key to expediting the modernization of legacy information technology systems1 increasing cybersecurity within and across departments and agencies1 and supporting the continued leadership of the ,united ,states in technology innovation and job creation4 7#b7 ,according to independent analysis1 as of calendar year #bjai1 the size of the cloud computing market had tripled since #bjjd1 enabling more than #b1jjj1jjj jobs and adding more than #bjj1jjj1jjj1jjj to the gross domestic product of the ,united ,states4 7#c7 ,the ,federal ,government1 across multiple presidential administrations and ,congresses1 has continued to support the ability of agencies to move to the cloud1 including through-- 7,a7 ,president ,barack ,obama's ,cloud ,first ,strategy2 7,b7 ,president ,donald ,trump's ,cloud ,smart ,strategy2 7,c7 the prioritization of cloud security in ,executive ,order #adbjh 7#hf ,fed4 ,reg4 #bffcc2 relating to improving the ,nation's cybersecurity71 which was issued by ,president ,joe ,biden2 and 7,d7 more than a decade of appropriations and authorization legislation that provides agencies with relevant authorities and appropriations to modernize on-premises information technology systems and more readily adopt cloud computing products and services4 7#d7 ,since it was created in #bjaa1 the ,federal ,risk and ,authorization ,management ,program 7referred to in this section as ,fed,r,a,m,p7 at the ,general ,services ,administration has made steady and sustained improvements in supporting the secure authorization and reuse of cloud computing products and services within the ,federal ,government1 including by reducing the costs and burdens on both agencies and cloud companies to quickly and securely enter the ,federal market4 7#e7 ,according to data from the ,general ,services ,administration1 as of the end of fiscal year #bjba1 there were #bci cloud providers with ,fed,r,a,m,p authorizations1 and those authorizations had been reused more than #b1gjj times across various agencies4 7#f7 ,providing a legislative framework for ,fed,r,a,m,p and new authorities to the ,general ,services ,administration1 the ,office of ,management and ,budget1 and ,federal agencies will-- 7,a7 improve the speed at which new cloud computing products and services can be securely authorized2 7,b7 enhance the ability of agencies to effectively evaluate ,fed,r,a,m,p authorized providers for reuse2 7,c7 reduce the costs and burdens to cloud providers seeking a ,fed,r,a,m,p authorization2 and 7,d7 provide for more robust transparency and dialogue between industry and the ,federal ,government to drive stronger adoption of secure cloud capabilities1 create jobs1 and reduce wasteful legacy information technology4 #c4 ,title #dd amendments 7a7 ,amendment ,chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #cfjg4 ,definitions 7a7 ,in general ,except as provided under subsection 7b71 the definitions under sections #cejb and #ceeb apply to this section through section #cfaf4 7b7 ,additional definitions ,in this section through section #cfaf3 7#a7 ,cloud computing ,the term cloud computing has the meaning given the term in ,special ,publication #hjj-ade of the ,national ,institute of ,standards and ,technology4 7#b7 ,cloud service provider ,the term cloud service provider means an entity offering cloud computing products or services to agencies4 7#c7 ,fed,r,a,m,p ,the term ,fed,r,a,m,p means the ,federal ,risk and ,authorization ,management ,program established under section #cfjh4 7#d7 ,fed,r,a,m,p authorization ,the term ,fed,r,a,m,p authorization means a certification that a cloud computing product or service has-- 7,a7 completed a ,fed,r,a,m,p authorization process1 as determined by the ,administrator of ,general ,services2 or 7,b7 received a ,fed,r,a,m,p provisional authorization to operate1 as determined by the ,fed,r,a,m,p ,board4 7#e7 ,fed,r,a,m,p authorization package ,the term ,fed,r,a,m,p authorization package means the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated set of common controls for all cloud computing products and services authorized by ,fed,r,a,m,p4 7#f7 ,fed,r,a,m,p ,board ,the term ,fed,r,a,m,p ,board means the board established under section #cfaj4 7#g7 ,independent assessment organization ,the term independent assessment organization means a third-party organization accredited by the ,administrator of ,general ,services to undertake conformity assessments of cloud service providers and their products or services4 7#h7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 #cfjh4 ,federal ,risk and ,authorization ,management ,program ,there is established within the ,general ,services ,administration the ,federal ,risk and ,authorization ,management ,program4 ,the ,administrator of ,general ,services1 subject to section #cfac1 shall establish a ,government-wide program that provides a standardized1 reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies4 #cfji4 ,roles and responsibilities of the ,general ,services ,administration 7a7 ,roles and responsibilities ,the ,administrator of ,general ,services shall-- 7#a7 in consultation with the ,secretary1 develop1 coordinate1 and implement a process to support agency review1 reuse1 and standardization1 where appropriate1 of security assessments of cloud computing products and services1 including1 as appropriate1 oversight of continuous monitoring of cloud computing products and services1 pursuant to guidance issued by the ,director pursuant to section #cfac2 7#b7 establish processes and identify criteria consistent with guidance issued by the ,director under section #cfac to make a cloud computing product or service eligible for a ,fed,r,a,m,p authorization and validate whether a cloud computing product or service has a ,fed,r,a,m,p authorization2 7#c7 develop and publish templates1 best practices1 technical assistance1 and other materials to support the authorization of cloud computing products and services and increase the speed1 effectiveness1 and transparency of the authorization process1 consistent with standards established by the ,director of the ,national ,institute of ,standards and ,technology and relevant statutes2 7#d7 grant ,fed,r,a,m,p authorizations to cloud computing products and services consistent with the guidance and direction of the ,fed,r,a,m,p ,board2 7#e7 establish and maintain a public comment process for proposed guidance and other ,fed,r,a,m,p directives that may have a direct impact on cloud service providers and agencies before the issuance of such guidance or other ,fed,r,a,m,p directives2 7#f7 coordinate with the ,fed,r,a,m,p ,board1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and other entities identified by the ,administrator of ,general ,services1 with the concurrence of the ,director and the ,secretary1 to establish and regularly update a framework for continuous monitoring under section #ceec2 7#g7 provide a secure mechanism for storing and sharing necessary data1 including ,fed,r,a,m,p authorization packages1 to enable better reuse of such packages across agencies1 including making available any information and data necessary for agencies to fulfill the requirements of section #cfab2 7#h7 provide regular updates to applicant cloud service providers on the status of any cloud computing product or service during an assessment process2 7#i7 regularly review1 in consultation with the ,fed,r,a,m,p ,board1 the costs associated with the independent assessment services of the third-party organizations described in section #cfaa2 7#aj7 support the ,federal ,secure ,cloud ,advisory ,committee established pursuant to section #cfaf2 and 7#aa7 take such other actions as the ,administrator of ,general ,services may determine necessary to carry out ,fed,r,a,m,p4 7b7 ,website 7#a7 ,in general ,the ,administrator of ,general ,services shall maintain a public website to serve as the authoritative repository for ,fed,r,a,m,p1 including the timely publication and updates for all relevant information1 guidance1 determinations1 and other materials required under subsection 7a74 7#b7 ,criteria and process for ,fed,r,a,m,p authorization priorities ,the ,administrator of ,general ,services shall develop and make publicly available on the website described in paragraph 7#a7 the criteria and process for prioritizing and selecting cloud computing products and services that will receive a ,fed,r,a,m,p authorization1 in consultation with the ,fed,r,a,m,p ,board and the ,chief ,information ,officers ,council4 7c7 ,evaluation of automation procedures 7#a7 ,in general ,the ,administrator of ,general ,services1 in coordination with the ,secretary1 shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of ,fed,r,a,m,p authorizations1 including continuous monitoring of cloud computing products and services4 7#b7 ,means for automation ,not later than #a year after the date of enactment of this section1 and updated regularly thereafter1 the ,administrator of ,general ,services shall establish a means for the automation of security assessments and reviews4 7d7 ,metrics for authorization ,the ,administrator of ,general ,services shall establish annual metrics regarding the time and quality of the assessments necessary for completion of a ,fed,r,a,m,p authorization process in a manner that can be consistently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section #ceed in a manner that minimizes the agency reporting burden4 #cfaj4 ,fed,r,a,m,p ,board 7a7 ,establishment ,there is established a ,fed,r,a,m,p ,board to provide input and recommendations to the ,administrator of ,general ,services regarding the requirements and guidelines for1 and the prioritization of1 security assessments of cloud computing products and services4 7b7 ,membership ,the ,fed,r,a,m,p ,board shall consist of not more than #g senior officials or experts from agencies appointed by the ,director1 in consultation with the ,administrator of ,general ,services1 from each of the following3 7#a7 ,the ,department of ,defense4 7#b7 ,the ,department of ,homeland ,security4 7#c7 ,the ,general ,services ,administration4 7#d7 ,such other agencies as determined by the ,director1 in consultation with the ,administrator of ,general ,services4 7c7 ,qualifications ,members of the ,fed,r,a,m,p ,board appointed under subsection 7b7 shall have technical expertise in domains relevant to ,fed,r,a,m,p1 such as-- 7#a7 cloud computing2 7#b7 cybersecurity2 7#c7 privacy2 7#d7 risk management2 and 7#e7 other competencies identified by the ,director to support the secure authorization of cloud services and products4 7d7 ,duties ,the ,fed,r,a,m,p ,board shall-- 7#a7 in consultation with the ,administrator of ,general ,services1 serve as a resource for best practices to accelerate the process for obtaining a ,fed,r,a,m,p authorization2 7#b7 establish and regularly update requirements and guidelines for security authorizations of cloud computing products and services1 consistent with standards established by the ,director of the ,national ,institute of ,standards and ,technology1 to be used in the determination of ,fed,r,a,m,p authorizations2 7#c7 monitor and oversee1 to the greatest extent practicable1 the processes and procedures by which agencies determine and validate requirements for a ,fed,r,a,m,p authorization1 including periodic review of the agency determinations described in section #cfab7;b72 7#d7 ensure consistency and transparency between agencies and cloud service providers in a manner that minimizes confusion and engenders trust2 and 7#e7 perform such other roles and responsibilities as the ,director may assign1 with concurrence from the ,administrator of ,general ,services4 7e7 ,determinations of demand for cloud computing products and services ,the ,fed,r,a,m,p ,board may consult with the ,chief ,information ,officers ,council to establish a process1 which may be made available on the website maintained under section #cfji7;b71 for prioritizing and accepting the cloud computing products and services to be granted a ,fed,r,a,m,p authorization4 #cfaa4 ,independent assessment organizations 7a7 ,requirements for accreditation ,the ,administrator of ,general ,services may1 consistent with guidance issued by the ,director1 determine the requirements for accreditation of a third-party organization to perform independent assessments and other activities that will improve the overall performance of ,fed,r,a,m,p and reduce the cost of ,fed,r,a,m,p authorizations for cloud service providers4 ,such requirements may include developing or requiring certification programs for individuals employed by the third-party organization seeking accreditation4 7b7 ,certification ,the ,administrator of ,general ,services may accredit any third-party organization that meets the requirements for accreditation determined under subsection 7a74 ,if accredited pursuant to the requirements determined under subsection 7a71 a certified independent assessment organization may assess1 validate1 and attest to the quality and compliance of security assessment materials provided by cloud service providers4 #cfab4 ,roles and responsibilities of agencies 7a7 ,in general ,in implementing the requirements of ,fed,r,a,m,p1 the head of each agency shall1 consistent with guidance issued by the ,director pursuant to section #cfac-- 7#a7 promote the use of cloud computing products and services that meet ,fed,r,a,m,p security requirements and other risk-based performance requirements as determined by the ,director1 in consultation with the ,secretary2 7#b7 confirm whether there is a ,fed,r,a,m,p authorization in the secure mechanism provided under section #cfji7;a77#g7 before beginning the process of granting a ,fed,r,a,m,p authorization for a cloud computing product or service2 7#c7 to the extent practicable1 for any cloud computing product or service the agency seeks to authorize that has received a ,fed,r,a,m,p authorization1 use the existing assessments of security controls and materials within the ,fed,r,a,m,p authorization package2 and 7#d7 provide data and information required to the ,director pursuant to section #cfac to determine how agencies are meeting metrics established by the ,administrator of ,general ,services4 7b7 ,attestation ,upon completing an assessment or authorization activity with respect to a particular cloud computing product or service1 if an agency determines that the information and data the agency has reviewed under paragraph 7#b7 or 7#c7 of subsection 7a7 is wholly or substantially deficient for the purposes of performing an authorization of the cloud computing product or service1 the head of the agency shall document as part of the resulting ,fed,r,a,m,p authorization package the reasons for this determination4 7c7 ,submission of authorizations ,to operate required ,upon issuance of an agency authorization to operate based on a ,fed,r,a,m,p authorization1 the head of the agency shall provide a copy of its authorization to operate letter and any supplementary information required pursuant to section #cfji7;a7 to the ,administrator of ,general ,services4 7d7 ,submission of policies required ,not later than #ahj days after the date on which the ,director issues guidance in accordance with section #cfac1 the head of each agency1 acting through the agency chief information officer of the agency1 shall submit to the ,director all agency policies relating to the authorization of cloud computing products and services4 7e7 ,presumption of adequacy 7#a7 ,in general ,the assessment of security controls and materials within the authorization package for a ,fed,r,a,m,p authorization shall be presumed adequate for use in an agency authorization to operate cloud computing products and services4 7#b7 ,information security requirements ,the presumption under paragraph 7#a7 does not modify or alter-- 7,a7 the responsibility of any agency to ensure compliance with subchapter ,,ii of chapter #ce for any cloud computing products or services used by the agency2 or 7,b7 the authority of the head of any agency to make a determination that there is a demonstrable need for additional security requirements beyond the security requirements included in a ,fed,r,a,m,p authorization for a particular control implementation4 #cfac4 ,roles and responsibilities of the ,office of ,management and ,budget 7a7 ,roles and responsibilities ,the ,director shall-- 7#a7 in consultation with the ,administrator of ,general ,services and the ,secretary1 issue guidance that-- 7,a7 specifies the categories or characteristics of cloud computing products and services that are within the scope of ,fed,r,a,m,p2 7,b7 includes requirements for agencies to obtain a ,fed,r,a,m,p authorization when operating a cloud computing product or service described in subparagraph 7,a7 as a ,federal information system2 and 7,c7 encompasses1 to the greatest extent practicable1 all necessary and appropriate cloud computing products and services2 7#b7 issue guidance describing additional responsibilities of ,fed,r,a,m,p and the ,fed,r,a,m,p ,board to accelerate the adoption of secure cloud computing services by the ,federal ,government2 7#c7 oversee the effectiveness of ,fed,r,a,m,p and the ,fed,r,a,m,p ,board1 including the compliance by the ,fed,r,a,m,p ,board with the duties described in section #cfaj7;d72 and 7#d7 to the greatest extent practicable1 encourage and promote consistency of the assessment1 authorization1 adoption1 and use of cloud computing products and services within and across agencies4 #cfad4 ,authorization of appropriations for ,fed,r,a,m,p ,there is authorized to be appropriated to the ,administrator of ,general ,services #bj1jjj1jjj for each fiscal year for ,fed,r,a,m,p and the ,fed,r,a,m,p ,board4 #cfae4 ,reports to congress2 ,,gao report 7a7 ,reports to congress ,not later than #a year after the date of enactment of this section1 and annually thereafter1 the ,director shall submit to the ,committee on ,oversight and ,reform of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report that includes the following3 7#a7 ,during the preceding year1 the status1 efficiency1 and effectiveness of the ,general ,services ,administration under section #cfji and agencies under section #cfab and in supporting the speed1 effectiveness1 sharing1 reuse1 and security of authorizations to operate for cloud computing products and services4 7#b7 ,progress towards meeting the metrics required under section #cfji7;d74 7#c7 ,data on ,fed,r,a,m,p authorizations4 7#d7 ,the average length of time to issue ,fed,r,a,m,p authorizations4 7#e7 ,the number of ,fed,r,a,m,p authorizations submitted1 issued1 and denied for the preceding year4 7#f7 ,a review of progress made during the preceding year in advancing automation techniques to securely automate ,fed,r,a,m,p processes and to accelerate reporting under this section4 7#g7 ,the number and characteristics of authorized cloud computing products and services in use at each agency consistent with guidance provided by the ,director under section #cfac4 7b7 ,,gao report ,not later than #ahj days after the date of enactment of this section1 the ,comptroller ,general of the ,united ,states shall publish a report that includes an assessment of the following3 7#a7 ,the costs incurred by agencies and cloud service providers relating to the issuance of ,fed,r,a,m,p authorizations4 7#b7 ,the extent to which agencies have processes in place to continuously monitor cloud computing products and services operating as ,federal information systems4 7#c7 ,how often and for which categories of products agencies use ,fed,r,a,m,p authorizations4 7#d7 ,the unique costs and potential burdens incurred by cloud computing companies that are small business concerns 7as defined in section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a777 as a part of the ,fed,r,a,m,p authorization process4 #cfaf4 ,federal ,secure ,cloud ,advisory ,committee 7a7 ,establishment1 purposes1 and duties 7#a7 ,establishment ,there is established a ,federal ,secure ,cloud ,advisory ,committee 7referred to in this section as the ,committee7 to ensure effective and ongoing coordination of agency adoption1 use1 authorization1 monitoring1 acquisition1 and security of cloud computing products and services to enable agency mission and administrative priorities4 7#b7 ,purposes ,the purposes of the ,committee are the following3 7,a7 ,to examine the operations of ,fed,r,a,m,p and determine ways that authorization processes can continuously be improved1 including the following3 7i7 ,measures to increase agency reuse of ,fed,r,a,m,p authorizations4 7ii7 ,proposed actions that can be adopted to reduce the burden1 confusion1 and cost associated with ,fed,r,a,m,p authorizations for cloud service providers4 7iii7 ,measures to increase the number of ,fed,r,a,m,p authorizations for cloud computing services offered by small businesses concerns 7as defined by section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a7774 7iv7 ,proposed actions that can be adopted to reduce the burden and cost of ,fed,r,a,m,p authorizations for agencies4 7,b7 ,collect information and feedback on agency compliance with and implementation of ,fed,r,a,m,p requirements4 7,c7 ,serve as a forum that facilitates communication and collaboration among the ,fed,r,a,m,p stakeholder community4 7#c7 ,duties ,the duties of the ,committee include providing advice and recommendations to the ,administrator of ,general ,services1 the ,fed,r,a,m,p ,board1 and agencies on technical1 financial1 programmatic1 and operational matters regarding secure adoption of cloud computing products and services4 7b7 ,members 7#a7 ,composition ,the ,committee shall be comprised of not more than #ae members who are qualified representatives from the public and private sectors1 appointed by the ,administrator of ,general ,services1 in consultation with the ,director1 as follows3 7,a7 ,the ,administrator of ,general ,services or the ,administrator of ,general ,services's designee1 who shall be the ,chair of the ,committee4 7,b7 ,at least #a representative each from the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,institute of ,standards and ,technology4 7,c7 ,at least #b officials who serve as the ,chief ,information ,security ,officer within an agency1 who shall be required to maintain such a position throughout the duration of their service on the ,committee4 7,d7 ,at least #a official serving as ,chief ,procurement ,officer 7or equivalent7 in an agency1 who shall be required to maintain such a position throughout the duration of their service on the ,committee4 7,e7 ,at least #a individual representing an independent assessment organization4 7,f7 ,no fewer than #e representatives from unique businesses that primarily provide cloud computing services or products1 including at least two representatives from a small business concern 7as defined by section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a7774 7,g7 ,at least #b other representatives of the ,federal ,government as the ,administrator of ,general ,services determines necessary to provide sufficient balance1 insights1 or expertise to the ,committee4 7#b7 ,deadline for appointment ,each member of the ,committee shall be appointed not later than #ij days after the date of enactment of this section4 7#c7 ,period of appointment2 vacancies 7,a7 ,in general ,each non-,federal member of the ,committee shall be appointed for a term of #c years1 except that the initial terms for members may be staggered #a-1 #b-1 or #c-year terms to establish a rotation in which one-third of the members are selected each year4 ,any such member may be appointed for not more than #b consecutive terms4 7,b7 ,vacancies ,any vacancy in the ,committee shall not affect its powers1 but shall be filled in the same manner in which the original appointment was made4 ,any member appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of that term4 ,a member may serve after the expiration of that member's term until a successor has taken office4 7c7 ,meetings and rules of procedures 7#a7 ,meetings ,the ,committee shall hold not fewer than #c meetings in a calendar year1 at such time and place as determined by the ,chair4 7#b7 ,initial meeting ,not later than #abj days after the date of enactment of this section1 the ,committee shall meet and begin the operations of the ,committee4 7#c7 ,rules of procedure ,the ,committee may establish rules for the conduct of the business of the ,committee if such rules are not inconsistent with this section or other applicable law4 7d7 ,employee status 7#a7 ,in general ,a member of the ,committee 7other than a member who is appointed to the ,committee in connection with another ,federal appointment7 shall not be considered an employee of the ,federal ,government by reason of any service as such a member1 except for the purposes of section #egjc of title #e1 relating to travel expenses4 7#b7 ,pay not permitted ,a member of the ,committee covered by paragraph 7#a7 may not receive pay by reason of service on the ,committee4 7e7 ,applicability to the federal advisory committee act ,section #ad of the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,committee4 7f7 ,detail of employees ,any ,federal ,government employee may be detailed to the ,committee without reimbursement from the ,committee1 and such detailee shall retain the rights1 status1 and privileges of his or her regular employment without interruption4 7g7 ,postal services ,the ,committee may use the ,united ,states mails in the same manner and under the same conditions as agencies4 7h7 ,reports 7#a7 ,interim reports ,the ,committee may submit to the ,administrator of ,general ,services and ,congress interim reports containing such findings1 conclusions1 and recommendations as have been agreed to by the ,committee4 7#b7 ,annual reports ,not later than #edj days after the date of enactment of this section1 and annually thereafter1 the ,committee shall submit to the ,administrator of ,general ,services and ,congress a final report containing such findings1 conclusions1 and recommendations as have been agreed to by the ,committee4 4 7b7 ,technical and conforming amendment ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following new items3 #cfjg4 ,definitions4 #cfjh4 ,federal ,risk and ,authorization ,management ,program4 #cfji4 ,roles and responsibilities of the ,general ,services ,administration4 #cfaj4 ,fed,r,a,m,p ,board4 #cfaa4 ,independent assessment organizations4 #cfab4 ,roles and responsibilities of agencies4 #cfac4 ,roles and responsibilities of the ,office of ,management and ,budget4 #cfad4 ,authorization of appropriations for ,fed,r,a,m,p4 #cfae4 ,reports to congress2 ,,gao report4 #cfaf4 ,federal ,secure ,cloud ,advisory ,committee4 4 7c7 ,sunset 7#a7 ,in general ,effective on the date that is #e years after the date of enactment of this ,act1 chapter #cf of title #dd1 ,united ,states ,code1 is amended by striking sections #cfjg through #cfaf4 7#b7 ,conforming amendment ,effective on the date that is #e years after the date of enactment of this ,act1 the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by striking the items relating to sections #cfjg through #cfaf4 7d7 ,rule of construction ,nothing in this section or any amendment made by this section shall be construed as altering or impairing the authorities of the ,director of the ,office of ,management and ,budget or the ,secretary of ,homeland ,security under subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code4